Examples with Argument org.sonar.plugins.python.api.tree.Argument used on opensource projects

Example 11 with Argument

use of org.sonar.plugins.python.api.tree.Argument in project sonar-python by SonarSource.

the class VerifiedSslTlsCertificateCheck method sslSetVerifyCheck.

/**
 * Check for the <code>OpenSSL.SSL.Context.set_verify</code> flag settings.
 *
 * Searches for `set_verify` invocations on instances of `OpenSSL.SSL.Context`,
 * extracts the flags from the first argument, checks that the combination of flags is secure.
 *
 * @param subscriptionContext the subscription context passed by <code>Context.registerSyntaxNodeConsumer</code>.
 */
private static void sslSetVerifyCheck(SubscriptionContext subscriptionContext) {
    CallExpression callExpr = (CallExpression) subscriptionContext.syntaxNode();
    boolean isSetVerifyInvocation = ofNullable(callExpr.calleeSymbol()).map(Symbol::fullyQualifiedName).filter(SET_VERIFY::equals).isPresent();
    if (isSetVerifyInvocation) {
        List<Argument> args = callExpr.arguments();
        if (!args.isEmpty()) {
            Tree flagsArgument = args.get(0);
            if (flagsArgument.is(Tree.Kind.REGULAR_ARGUMENT)) {
                Set<QualifiedExpression> flags = extractFlags(((RegularArgumentImpl) flagsArgument).expression());
                checkFlagSettings(flags).ifPresent(issue -> subscriptionContext.addIssue(issue.token, MESSAGE));
            }
        }
    }
}

Example 12 with Argument

use of org.sonar.plugins.python.api.tree.Argument in project sonar-python by SonarSource.

the class XMLParserXXEVulnerableCheck method checkSettingFeatureGesToTrue.

private static boolean checkSettingFeatureGesToTrue(CallExpression callExpression) {
    List<Argument> arguments = callExpression.arguments();
    if (arguments.size() != 2 || arguments.stream().anyMatch(argument -> !argument.is(Tree.Kind.REGULAR_ARGUMENT))) {
        return false;
    }
    Expression first = ((RegularArgument) arguments.get(0)).expression();
    Expression second = ((RegularArgument) arguments.get(1)).expression();
    if (!(first instanceof HasSymbol)) {
        return false;
    }
    Symbol symbol = ((HasSymbol) first).symbol();
    if (symbol == null) {
        return false;
    }
    return "xml.sax.handler.feature_external_ges".equals(symbol.fullyQualifiedName()) && !Expressions.isFalsy(second);
}

Example 13 with Argument

use of org.sonar.plugins.python.api.tree.Argument in project sonar-python by SonarSource.

the class HttpOnlyCookieCheck method searchForFalsySessionCookieHttponlyInDictCons.

private static Optional<Expression> searchForFalsySessionCookieHttponlyInDictCons(CallExpression callExpression) {
    Symbol callee = callExpression.calleeSymbol();
    if (callee != null && "dict".equals(callee.fullyQualifiedName())) {
        for (Argument arg : callExpression.arguments()) {
            if (arg.is(Tree.Kind.REGULAR_ARGUMENT)) {
                RegularArgument regArg = (RegularArgument) arg;
                Name key = regArg.keywordArgument();
                if (key != null && SESSION_COOKIE_HTTPONLY.equals(key.name()) && Expressions.isFalsy(regArg.expression())) {
                    return Optional.of(regArg.expression());
                }
            }
        }
    }
    return Optional.empty();
}

Example 14 with Argument

use of org.sonar.plugins.python.api.tree.Argument in project sonar-python by SonarSource.

the class PubliclyWritableDirectoriesCheck method initialize.

@Override
public void initialize(Context context) {
    context.registerSyntaxNodeConsumer(Kind.STRING_ELEMENT, ctx -> {
        StringElement tree = (StringElement) ctx.syntaxNode();
        String stringElement = Expressions.unescape(tree).toLowerCase(Locale.ENGLISH);
        if (UNIX_WRITABLE_DIRECTORIES.stream().anyMatch(dir -> containsDirectory(stringElement, dir)) || WINDOWS_WRITABLE_DIRECTORIES.matcher(stringElement).matches()) {
            ctx.addIssue(tree, MESSAGE);
        }
    });
    context.registerSyntaxNodeConsumer(Kind.CALL_EXPR, ctx -> {
        CallExpression tree = (CallExpression) ctx.syntaxNode();
        List<Argument> arguments = tree.arguments();
        if (isOsEnvironGetter(tree) && arguments.stream().filter(arg -> arg.is(Kind.REGULAR_ARGUMENT)).map(RegularArgument.class::cast).map(RegularArgument::expression).anyMatch(PubliclyWritableDirectoriesCheck::isNonCompliantOsEnvironArgument)) {
            ctx.addIssue(tree, MESSAGE);
        }
    });
    context.registerSyntaxNodeConsumer(Kind.SUBSCRIPTION, ctx -> {
        SubscriptionExpression tree = (SubscriptionExpression) ctx.syntaxNode();
        if (isOsEnvironQualifiedExpression(tree.object()) && tree.subscripts().expressions().stream().anyMatch(PubliclyWritableDirectoriesCheck::isNonCompliantOsEnvironArgument)) {
            ctx.addIssue(tree, MESSAGE);
        }
    });
}

Example 15 with Argument

use of org.sonar.plugins.python.api.tree.Argument in project sonar-python by SonarSource.

the class DebugModeCheck method initialize.

@Override
public void initialize(Context context) {
    context.registerSyntaxNodeConsumer(Kind.CALL_EXPR, ctx -> {
        CallExpression callExpression = (CallExpression) ctx.syntaxNode();
        List<Argument> arguments = callExpression.arguments();
        if (!(callExpression.callee() instanceof QualifiedExpression)) {
            return;
        }
        if ("django.conf.settings.configure".equals(getQualifiedName(callExpression)) && !arguments.isEmpty()) {
            arguments.stream().filter(DebugModeCheck::isDebugArgument).forEach(arg -> ctx.addIssue(arg, MESSAGE));
        }
    });
    context.registerSyntaxNodeConsumer(Kind.ASSIGNMENT_STMT, ctx -> {
        if (!settingFiles.contains(ctx.pythonFile().fileName())) {
            return;
        }
        AssignmentStatement assignmentStatementTree = (AssignmentStatement) ctx.syntaxNode();
        for (ExpressionList lhsExpression : assignmentStatementTree.lhsExpressions()) {
            boolean isDebugProperties = lhsExpression.expressions().stream().anyMatch(DebugModeCheck::isDebugIdentifier);
            if (isDebugProperties && isTrueLiteral(assignmentStatementTree.assignedValue())) {
                ctx.addIssue(assignmentStatementTree, MESSAGE);
            }
        }
    });
}